CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2014-05-14
Microsoft Windows Group Policy Preferences (GPP) Credential Disclosure & Privilege Escalation (CVE-2014-1812, MS14-025)
[Affected Scope] Active Directory environments running Windows Vista SP2, 7 SP1, 8, 8.1, and Windows Server 2008 SP2/R2 SP1, 2012 Gold/R2 domain controllers and client systems
[Impact] Remote authenticated domain users can access the SYSVOL share, retrieve encrypted GPP XML files, and decrypt them using a publicly known AES key to obtain domain administrator credentials
[Mitigation] Apply the MS14-025 cumulative security update and permanently delete existing XML configuration files containing the 'cpassword' attribute from the SYSVOL share